Errors after deleting a tenant (Unable to retrieve <resource> list)

[Denis Kostryukov]

After deleting a tenant via Horizon which is selected in the upper drop-down box, we get errors like “unable to retrieve <resource> list” when trying to access projects, networks or other resources.

This is expected, since the corresponding tenant is deleted, but is it possible to automatically switch the tenant to "admin" in this situation?

MOS 5.1
Diagnostic snapshot:
https://drive.google.com/a/mirantis.com/file/d/0B1eJLkMydYieRmRXQ01LbTJMWmM/view?usp=sharing

[Nastya Urlapova (aurlapova)]

Could you provide iso version and diagnostic snapshot?

[Denis Kostryukov (dkostryukov)]

Diagnostic snapshot is here https://drive.google.com/a/mirantis.com/file/d/0B1eJLkMydYieRmRXQ01LbTJMWmM/view?usp=sharing

[Timur Sufiev (tsufiev-x)]

Upstream bug 1166585, starting from comment#3

[Timur Sufiev (tsufiev-x)]

Again, this one looks similar to the token revocation issues in Keystone and the authentication/authorization stuff.

[Timur Sufiev (tsufiev-x)]

It seems that we aren't able to fix it in 6.1 before SCF this Thursday, thus moving to 7.0.

[Kyrylo Romanenko (kromanenko)]

I have one more way to reproduce this bug without deletion of tenant:

Steps:
1) Login to Horizon as admin
2) Go to Identity -> Project
3) Create new project "NEW" .
4) Add "admin" as roles of "_member_" and "admin" to this project.
5) Remove "admin" role of admin user from NEW project.
6) Try to view Projects and Users pages, you will get "Unable to retrieve <resource> list".

Juno on CentOS 6.5
VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "6.1"
  openstack_version: "2014.2.2-6.1"
  api: "1.0"
  build_number: "354"
  build_id: "2015-04-27_09-17-29"
  nailgun_sha: "2efc207e7156e362c2506b66e63b8bfa745d1153"
  python-fuelclient_sha: "2b311b3b82a1e2df1dc3484a0f37e282273cd988"
  astute_sha: "c1793f982fda7e3fc7b937ccaa613c649be6a144"
  fuel-library_sha: "6bdf783e2bffdce80ecffcca2915e6d32a8ccdd7"
  fuel-ostf_sha: "b38602c841deaa03ddffc95c02f319360462cbe3"
  fuelmain_sha: "01288380950bc89d572cf5902141c9a393ada950"

[Vlad Okhrimenko (vokhrimenko)]

upstream bug on review https://review.openstack.org/#/c/142481/

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-7.0/2015.1.0
Change author: Vlad Okhrimenko <email address hidden>
Review: https://review.fuel-infra.org/10146

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/10146
Submitter: mos-infra-ci <>
Branch: openstack-ci/fuel-7.0/2015.1.0

Commit: cf55c8509f5e66ec3abeaa2477ef0fb1c12ee562
Author: Vlad Okhrimenko <email address hidden>
Date: Thu Aug 6 12:32:00 2015

Logout user if he has no valid tokens

Before this patch, if user's rights were changed
or revoked - there would be "Unauthorized" errors
on every page since user had no rights to view them
because he had no valid tokens in that case.

Now user will be logged out if he has no valid tokens.
Set `escalate` to True (for unauthorized-error)
to always log user out.

Also, now horizon.exceptions.NotAuthorized is a part of
UNAUTHORIZED tuple in the exceptions.py, because this type
of exception is re-raised after handling services unauthorized errors.
Looks like it was missing. Now the horizon.exceptions.NotAuthorized
is handled like all NotAuthorized exceptions.

And horizon_middleware.py in process_exception now generates
logout_reason for cases if user is not authorized.

Closes-Bug: #1387132
Closes-Bug: #1391185
Closes-Bug: #1463386
Co-Authored-By: Vlad Okhrimenko <email address hidden>

Conflicts:

 openstack_dashboard/dashboards/project/overview/tests.py

Change-Id: I806fd54b5db3938feac446cae16f85a8fb02b273

[Anastasia Kuznetsova (akuznetsova)]

Verified on ISO 288
Now user will automatically log out and won't use invalid token

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-8.0/liberty
Change author: Vlad Okhrimenko <email address hidden>
Review: https://review.fuel-infra.org/13362

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Paul Karikh <email address hidden> on branch: openstack-ci/fuel-8.0/liberty
Review: https://review.fuel-infra.org/13362